A YANG Data Model for Terminal Access Controller Access-Control System Plus (TACACS+)
obsoleted by
- rfc-9950 — A YANG Data Model for Terminal Access Controller Access-Control System Plus (TACACS+)
Extracted elements (22)
Most parameters in the 'server' list are taken directly from the TACACS+ protocol (RFC 8907); additional parameters such as source-address selection and VRF instance are derived from common network equipment manufacturer implementations to reflect real deployment needs.
The module augments the '/sys:system' path from RFC 7317 rather than defining a standalone model, so devices can use local, RADIUS, or TACACS+ authentication interchangeably within the same System Management data model.
The shared-secret leaf is labeled 'obfuscation' rather than 'encryption' because the TACACS+ mechanism provides no meaningful integrity, privacy, or replay protection; the naming makes the security limitation explicit to operators.
The 'server' list is 'ordered-by user', meaning the client tries servers in the order configured by the operator, providing deterministic failover behavior consistent with common network equipment implementations.
A YANG 'must' constraint enforces that when 'tacacs-plus' appears in 'user-authentication-order', at least one server with the 'authentication' bit set must be configured; violation produces an error-message.
TACACS+ MUST be used within a secure deployment. The module does not endorse the security mechanisms of the TACACS+ protocol itself.
TACACS+ server administrators SHOULD configure a shared secret with a minimum length of 16 characters; it is highly recommended the secret be at least 32 characters and include upper case, lower case, numeric, and punctuation characters.
The 'security' choice is mandatory on each server entry. The only built-in case is 'obfuscation', which requires a non-empty 'shared-secret' string. The choice is modeled as a YANG 'choice' to allow augmentation in a backwards-compatible manner.
The 'single-connection' leaf (boolean, default false) controls whether Single Connection Mode is enabled for the server. When enabled, a single TCP connection may carry multiple TACACS+ sessions, and the 'sessions' statistic counter will exceed 'connection-closes'.
The 'source-type' choice allows specifying either a 'source-ip' (inet:ip-address) or a 'source-interface' (if:interface-ref) as the source for outbound TACACS+ packets; the choice is optional.
The 'statistics' container (config false) provides nine read-only yang:counter64 counters: connection-opens, connection-closes, connection-aborts, connection-failures, connection-timeouts, messages-sent, messages-received, errors-received, and sessions.
The 'tacacs-plus' container holds a 'server' list keyed by name. Each server entry carries server-type (authentication/authorization/accounting bitmask), address, port, security choice, optional source address or interface, optional VRF instance, single-connection flag, and a read-only statistics container.
The 'tacacs-plus-server-type' typedef is a YANG bits type with three bits: 'authentication', 'authorization', and 'accounting', allowing any combination of AAA service types to be assigned to a single server entry.
The 'tacacs-plus' YANG identity derives from 'sys:authentication-method', enabling TACACS+ to be listed in 'user-authentication-order' alongside local and RADIUS methods.
The 'timeout' leaf (uint16, range 1..max, default 5 seconds) specifies how long the device waits for a response from a TACACS+ server before trying the next server in the list.
The 'vrf-instance' leaf is a leafref to '/ni:network-instances/network-instance/name' (RFC 8529), allowing communication with a TACACS+ server located in a specific VPN Routing and Forwarding instance.
IANA registered the URI 'urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus' in the 'ns' subregistry of the IETF XML Registry (RFC 3688), and registered the module name 'ietf-system-tacacs-plus' with prefix 'sys-tcs-plus' in the YANG Module Names registry.
Management access to the YANG module MUST use a secure transport: NETCONF over SSH (RFC 6242) or RESTCONF over HTTPS/TLS 1.3 (RFC 8446). NACM (RFC 8341) SHOULD be used to restrict access to sensitive data nodes.
The module inherits all threats present in TACACS+ applications as described in Section 10 of RFC 8907, including the weak obfuscation of packet bodies using MD5.
The 'shared-secret' leaf is protected with 'nacm:default-deny-all' (RFC 8341) to prevent unauthorized read or write access; unauthorized access to this leaf makes the device vulnerable to attacks exploiting the TACACS+ obfuscation mechanism.
The '/system/tacacs-plus/server' list is sensitive because unauthorized write access could redirect the device to a compromised TACACS+ server, granting an attacker full device control, or modify statistics counters to conceal attacks.
The 'port' leaf defaults to 49 (the registered TACACS+ port), typed as inet:port-number. The 'address' leaf is typed as inet:host, accommodating both IP addresses and hostnames.